""ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98""

SID: 2014562

Revision: 4

Class Type: trojan-activity

Metadata: created_at 2012_04_13, updated_at 2013_12_04

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE 5.0|3b 20|Windows 98)"

  • Value: "*|3b|q=0"

  • Value: "HTTP/1.0|0d 0a|Host|3a 20|"

Within:

PCRE:

Special Options:

  • http_header

  • http_header

source